Deriving a closed-form expression for worm-scanning strategies

International Journal of Security and Networks

Volumn 4, Issue 3, 2009, Pages 135-144

  Chen, Zesheng ^a   Chen, Chao ^b   Li, Yubin ^a  

^a The Department of Electrical and Computer Engineering   (United States)

^b INDIANA UNIVERSITY PURDUE UNIVERSITY FORT WAYNE   (United States)

Author keywords

Closed form expression; Mean field theory; Modelling; Security; Worm scanning strategy

Indexed keywords

MEAN FIELD THEORY; MODELS;

CLOSED-FORM EXPRESSION; MEAN FIELD APPROXIMATION; MEAN VALUES; SCANNING METHODS; SCANNING STRATEGIES; SECURITY; SELF-LEARNING; WORM PROPAGATION;

SCANNING;

EID: 68149168162     PISSN: 17478405     EISSN: 17478413     Source Type: Journal    
DOI: 10.1504/IJSN.2009.027339     Document Type: Article

References (29)

1. Baccelli, F., Chaintreau, A., Vleeschauwer, D.D. and McDonald, D.R. (2004) 'A mean-field analysis of short lived interacting flows', Proc. ACM SIGMETRICS, June, New York, pp.343-354.
2. Barford, P., Nowak, R., Willett, R. and Yegneswaran, V. (2006) 'Toward a model for sources of internet background radiation', Proc. Passive and Active Measurement Conference (PAM'06), March, Adelaide, Australia.
3. Chen, Z. and Chen, C. (2008) 'A closed-form expression for static worm-scanning strategies', Proc. IEEE International Conference on Communications (ICC'08), May, Beijing, China, pp.1573-1577.
4. Chen, Z., Chen, C. and Ji, C. (2007) 'Understanding localized-scanning worms', Proc. 26th IEEE International Performance Computing and Communications Conference (IPCCC'07), April, New Orleans, LA, pp.186-193.
5. Chen, Z., Gao, L. and Kwiat, K. (2003) 'Modeling the spread of active worms', Proc. INFOCOM'03, April, Vol. 3, San Francisco, CA, pp.1890-1900.
6. Chen, Z. and Ji, C. (2005a) 'Spatial-temporal modeling of malware propagation in networks', IEEE Transactions on Neural Networks: Special Issue on Adaptive Learning Systems in Communication Networks, Vol. 16, No. 5, September, pp.1291-1303.
7. Chen, Z. and Ji, C. (2005b) 'A self-learning worm using importance scanning', Proc. ACM/CCS Workshop on Rapid Malcode (WORM'05), November, Fairfax, VA, pp.22-29.
8. Chen, Z. and Ji, C. (2007) 'Optimal worm-scanning method using vulnerable-host distributions', International Journal of Security and Networks: Special Issue on Computer and Network Security, Vol. 2, Nos. 1-2, pp.71-80.
9. Chen, Z., Ji, C. and Barford, P. (2008) 'Spatial-temporal characteristics of internet malicious sources', Proc. INFOCOM'08 Mini-Conference, April, Phoenix, AZ, pp.271-275.
10. Distributed Intrusion Detection System (DShield) (2009) May, http://www.dshield.org/
11. Moore, D., Shannon, C. and Brown, J. (2002) 'Code-Red: A case study on the spread and victims of an internet worm', ACM SIGCOMM Internet Measurement Workshop, November, Marseille, France, pp.273-284.
12. Moore, D., Shannon, C., Voelker, G. and Savage, S. (2003) 'Internet quarantine: Requirements for containing self-propagating code', Proc. INFOCOM'03, Vol. 3, April, San Francisco, CA, pp.1901-1910.
13. Nicol, D.M. (2006) 'The impact of stochastic variance on worm propagation and detection', Proc. ACM/CCS Workshop on Rapid Malcode (WORM'06), November, Fairfax, VA, pp.57-64.
14. Opper, M. and Saad, D. (Eds.) (2001) Advanced Mean Field Methods, Theory and Practice, MIT Press, Cambridge, Massachusetts, February.
15. Rajab, M.A., Monrose, F. and Terzis, A. (2005) 'On the effectiveness of distributed worm monitoring', Proc. 14th USENIX Security Symposium (Security'05), August, Baltimore, MD, pp.225-237.
16. Rohloff, K. and Basar, T. (2005) 'Stochastic behavior of random constant scanning worms', Proc. 14th ICCCN, San Diego, California, USA, pp.339-344.
17. Shannon, C. and Moore, D. (2004) 'The spread of the Witty worm', IEEE Security and Privacy, Vol. 2, No. 4, July-August, pp.46-50.
18. Staniford, S., Paxson, V. and Weaver, N. (2002) 'How to 0wn the internet in your spare time', Proc. 11th USENIX Security Symposium (Security'02), August, San Francisco, CA, pp.149-167.
19. The CAIDA (2004) Dataset on the Witty Worm, March 19-24, Colleen Shannon and David Moore, http://www.caida.org/data/passive/ witty_worm⊣taset.xml. Support for the Witty Worm Dataset and the UCSD Network Telescope are provided by Cisco Systems, Limelight Networks, the US Department of Homeland Security, the National Science Foundation, DARPA, Digital Envoy, and CAIDA Members.
20. Vojnovic, M. and Ganesh, A.J. (2008) 'On the race of worms, alerts and patches', IEEE/ACM Transactions on Networking, Vol. 16, No. 5, pp.1066-1079.
21. Vojnovic, M., Gupta, V., Karagiannis, T. and Gkantsidis, C. (2008) 'Sampling strategies for epidemic-style information dissemination', Proc. INFOCOM'08, April, Phoenix, AZ, pp.2351-2359.
22. Wang, M. (2007) 'Mean-field analysis of buffer sizing', Proc. 50th Annual IEEE Global Communications Conference (GLOBECOM'07), November, Washington DC, pp.2645-2649.
23. Wu, J., Vangala, S., Gao, L. and Kwiat, K. (2004) 'An effective architecture and algorithm for detecting worms with various scan techniques', Proc. 11th Ann. Network and Distributed System Security Symposium (NDSS'04), February, San Diego, CA,
24. Zou, C.C., Gong, W., Towsley, D. and Gao, L. (2005) 'The monitoring and early detection of internet worms', IEEE/ACM Transactions on Networking, Vol. 13, No. 5, October, pp.961-974.
25. Zou, C.C., Towsley, D., Gong, W. and Cai, S. (2006a) 'Advanced routing worm and its security challenges', Simulation: Transactions of the Society for Modeling and Simulation International, Vol. 82, No. 1, pp.75-85.
26. Zou, C.C., Towsley, D. and Gong, W. (2006b) 'On the performance of internet worm scanning strategies', Elsevier Journal of Performance Evaluation, Vol. 63, No. 7, July, pp.700-723.
27. Wikipedia (2009) Mean Field Theory, May, http://en.wikipedia.org/wiki/ Mean_field_theory
28. Wikipedia (2009) Riccati Equation, May, http://en.wikipedia.org/wiki/ Riccati_equation
29. Wolfram MathWorld (2009) Logistic Equation, May, http:// mathworld.wolfram.com/LogisticEquation.html